@aifabrix/builder 2.45.5 → 2.46.0

package/lib/core/config.js

@@ -9,14 +9,24 @@
  */
 
 const fs = require('fs').promises;
-const path = require('path');
 const yaml = require('js-yaml');
-const os = require('os');
 const { encryptToken, decryptToken, isTokenEncrypted } = require('../utils/token-encryption');
 const { ensureSecureFilePermissions, ensureSecureDirPermissions } = require('../utils/secure-file-permissions');
 const { getRuntimeConfigDir, getRuntimeConfigFile } = require('./config-runtime-paths');
 const { getAdminEmailFromConfig, setAdminEmailInConfig } = require('./config-admin-email');
+const {
+  getSetupInstallationProfileFromConfig,
+  setSetupInstallationProfileInConfig
+} = require('./config-setup-installation-profile');
+const {
+  getSetupPlatformModeFromConfig,
+  setSetupPlatformModeInConfig
+} = require('./config-setup-platform-mode');
 const { getRegisteredControllerUrlsWithLoader } = require('./config-registered-controller-urls');
+const {
+  getPlatformControllerUrlFromConfig,
+  setPlatformControllerUrlInConfig
+} = require('./config-platform-controller');
 const { normalizeControllerUrl, validateAndNormalizeDeveloperId } = require('./config-normalize');
 // Avoid importing paths.js here to prevent circular dependency; use shared runtime config dir helper.
 // Config location: AIFABRIX_CONFIG dirname → AIFABRIX_HOME (with ~/.aifabrix fallback when config lives there) → ~/.aifabrix
@@ -34,6 +44,9 @@ function applyConfigDefaults(config) {
   if (typeof config.environment === 'undefined') {
     config.environment = 'dev';
   }
+  if (typeof config.setupPlatformMode === 'undefined') {
+    config.setupPlatformMode = 'single';
+  }
   // Ensure environments object exists
   if (typeof config.environments !== 'object' || config.environments === null) {
     config.environments = {};
@@ -59,6 +72,7 @@ function getDefaultConfig() {
   return {
     'developer-id': '0',
     environment: 'dev',
+    setupPlatformMode: 'single',
     controller: undefined,
     environments: {},
     device: {},
@@ -230,6 +244,12 @@ async function setAdminEmail(email) {
   return setAdminEmailInConfig(getConfig, saveConfig, email);
 }
 
+/** @returns {Promise<'dev'|'pro'>} */
+const getSetupInstallationProfile = () => getSetupInstallationProfileFromConfig(getConfig);
+/** @param {unknown} profile @returns {Promise<'dev'|'pro'>} */
+const setSetupInstallationProfile = (profile) =>
+  setSetupInstallationProfileInConfig(getConfig, saveConfig, profile);
+
 /**
  * Whether Traefik is enabled (`traefik: true` in config; infra compose includes the proxy).
  * @returns {Promise<boolean>}
@@ -259,6 +279,21 @@ async function setCurrentEnvironment(environment) {
   await saveConfig(config);
 }
 
+/**
+ * @returns {Promise<'single'|'full'>}
+ */
+async function getSetupPlatformMode() {
+  return getSetupPlatformModeFromConfig(getConfig);
+}
+
+/**
+ * @param {unknown} mode
+ * @returns {Promise<'single'|'full'>}
+ */
+async function setSetupPlatformMode(mode) {
+  return setSetupPlatformModeInConfig(getConfig, saveConfig, mode);
+}
+
 /**
  * Set controller URL in configuration
  * @async
@@ -392,38 +427,11 @@ async function setSecretsEncryptionKey(key) {
  */
 async function ensureSecretsEncryptionKey() {
   const { ensureSecretsEncryptionKey: run } = require('./ensure-encryption-key');
+  const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
+  const { getSecretsPath } = createSecretsPathFunctions(getConfig, saveConfig);
   await run({ getSecretsEncryptionKey, setSecretsEncryptionKey, getSecretsPath });
 }
 
-/**
- * Expand leading ~ to home directory so config paths like ~/.aifabrix/secrets.local.yaml resolve correctly.
- * @param {string} filePath - Path that may start with ~ or ~/
- * @returns {string} Path with ~ expanded, or unchanged if no leading ~
- */
-function expandTilde(filePath) {
-  if (!filePath || typeof filePath !== 'string') return filePath;
-  if (filePath === '~') return os.homedir();
-  if (filePath.startsWith('~/') || filePath.startsWith('~' + path.sep)) {
-    return path.join(os.homedir(), filePath.slice(2));
-  }
-  return filePath;
-}
-
-async function getSecretsPath() {
-  const config = await getConfig();
-  const raw = config['aifabrix-secrets'] || config['secrets-path'] || null;
-  return raw ? expandTilde(raw) : null;
-}
-
-async function setSecretsPath(secretsPath) {
-  if (typeof secretsPath !== 'string') {
-    throw new Error('Secrets path is required and must be a string');
-  }
-  const config = await getConfig();
-  config['aifabrix-secrets'] = secretsPath.trim() || undefined;
-  await saveConfig(config);
-}
-
 // Create exports object
 const exportsObj = {
   getConfig,
@@ -436,6 +444,10 @@ const exportsObj = {
   getTlsEnabled,
   getAdminEmail,
   setAdminEmail,
+  getSetupInstallationProfile,
+  setSetupInstallationProfile,
+  getSetupPlatformMode,
+  setSetupPlatformMode,
   getTraefikEnabled,
   setCurrentEnvironment,
   resolveEnvironment,
@@ -446,11 +458,11 @@ const exportsObj = {
   getSecretsEncryptionKey,
   setSecretsEncryptionKey,
   ensureSecretsEncryptionKey,
-  getSecretsPath,
-  setSecretsPath,
   normalizeControllerUrl,
   setControllerUrl,
   getControllerUrl,
+  getPlatformControllerUrl: () => getPlatformControllerUrlFromConfig(getConfig),
+  setPlatformControllerUrl: (url) => setPlatformControllerUrlInConfig(getConfig, saveConfig, normalizeControllerUrl, url),
   getRegisteredControllerUrls,
   get CONFIG_DIR() {
     return getRuntimeConfigDir();
@@ -460,9 +472,7 @@ const exportsObj = {
   }
 };
 
-// Add developerId as a property getter for direct access
-// After getConfig() or getDeveloperId() is called, config.developerId will be available
-// Developer ID: 0 = default infra, > 0 = developer-specific
+// Developer ID: 0 = default infra, > 0 = developer-specific (getter after getConfig loads cache)
 Object.defineProperty(exportsObj, 'developerId', {
   get() {
     return cachedDeveloperId !== null ? cachedDeveloperId : '0'; // Default to "0" if not loaded yet

package/lib/core/secrets-admin-env.js

@@ -20,6 +20,7 @@ const {
 const { createDefaultSecrets } = require('../utils/secrets-generator');
 const pathsUtil = require('../utils/paths');
 const { loadSecrets } = require('./secrets-load');
+const { formatAdminEnvLine } = require('./admin-secrets');
 
 /**
  * Writes admin env key-value pairs to content; encrypts values when encryption key is set.
@@ -34,7 +35,7 @@ async function formatAdminSecretsContent(adminObj) {
   for (const [k, v] of Object.entries(adminObj)) {
     const value = (v === null || v === undefined) ? '' : String(v).replace(/\n/g, ' ').trim();
     const valueToWrite = encryptionKey ? encryptSecret(value, encryptionKey) : value;
-    lines.push(`${k}=${valueToWrite}`);
+    lines.push(formatAdminEnvLine(k, valueToWrite));
   }
   return lines.join('\n');
 }
@@ -76,7 +77,10 @@ function buildLocalAdminSecretsObject(secrets, infraDefaults) {
     PGADMIN_DEFAULT_PASSWORD: postgresPassword,
     REDIS_HOST: 'local:redis:6379:0:',
     REDIS_COMMANDER_USER: 'admin',
-    REDIS_COMMANDER_PASSWORD: postgresPassword
+    REDIS_COMMANDER_PASSWORD: postgresPassword,
+    KEYCLOAK_ADMIN_USERNAME: 'admin',
+    KEYCLOAK_ADMIN_PASSWORD: postgresPassword,
+    PLATFORM_ADMIN_PASSWORD: postgresPassword
   };
 }
 

package/lib/core/secrets-ensure.js

@@ -204,6 +204,8 @@ function summarizeSecretsStoreForLog(target) {
  */
 function logNewSecretValuesWritten(added, target) {
   if (!Array.isArray(added) || added.length === 0) return;
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (isSetupQuietOutput()) return;
   const where = summarizeSecretsStoreForLog(target);
   logger.log(
     formatSuccessLine(
@@ -352,6 +354,8 @@ async function ensureSecretsFromEnvTemplate(envTemplatePathOrContent, options =
  * @returns {Promise<void>}
  */
 async function writeSecretToStoreFile(filePath, key, strValue) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(filePath);
   const existing = loadExistingSecrets(filePath);
   const encryptionKey = await config.getSecretsEncryptionKey();
   let valueToWrite = strValue;

package/lib/core/secrets-env-content.js

@@ -15,7 +15,6 @@ const config = require('./config');
 const {
   interpolateEnvVars,
   collectMissingSecrets,
-  formatMissingSecretsFileInfo,
   replaceKvInContent,
   loadEnvTemplate,
   adjustLocalEnvPortsInContent,
@@ -43,6 +42,8 @@ const {
   rewriteDockerManifestPublicPortEnvLine
 } = require('../utils/docker-manifest-public-port');
 const { loadSecrets } = require('./secrets-load');
+const { buildMissingSecretsErrorMessage } = require('../utils/secrets-missing-error');
+const { commentOrphanKvEnvLines } = require('../utils/env-kv-orphan-lines');
 
 /**
  * Resolves kv:// references in environment template
@@ -54,10 +55,24 @@ const { loadSecrets } = require('./secrets-load');
  * @param {string} [environment='local'] - Environment context (docker/local)
  * @param {Object|string|null} [secretsFilePaths] - Paths object with userPath and buildPath, or string path (for backward compatibility)
  * @param {string} [appName] - Application name (optional, for error messages)
+ * @param {Object|null} [resolveOpts] - Scoped kv (`envKey`, `effective`) and/or `envTemplatePath` for error hints
  * @returns {Promise<string>} Resolved environment content
  * @throws {Error} If kv:// reference cannot be resolved
  */
-async function resolveKvReferences(envTemplate, secrets, environment = 'local', secretsFilePaths = null, appName = null, scopedKv = null) {
+async function resolveKvReferences(
+  envTemplate,
+  secrets,
+  environment = 'local',
+  secretsFilePaths = null,
+  appName = null,
+  resolveOpts = null
+) {
+  const envTemplatePath =
+    resolveOpts && typeof resolveOpts === 'object' ? resolveOpts.envTemplatePath || null : null;
+  const scopedKv =
+    resolveOpts && typeof resolveOpts === 'object' && (resolveOpts.envKey !== undefined || resolveOpts.effective !== undefined)
+      ? { envKey: resolveOpts.envKey, effective: resolveOpts.effective }
+      : null;
   const os = require('os');
 
   let developerId = null;
@@ -77,9 +92,16 @@ async function resolveKvReferences(envTemplate, secrets, environment = 'local',
   const resolved = interpolateEnvVars(envTemplate, envVars);
   const missing = collectMissingSecrets(resolved, secrets, scopedKv);
   if (missing.length > 0) {
-    const fileInfo = formatMissingSecretsFileInfo(secretsFilePaths);
-    const resolveCommand = appName ? `aifabrix resolve ${appName}` : 'aifabrix resolve <app-name>';
-    throw new Error(`Missing secrets: ${missing.join(', ')}${fileInfo}\n\nRun "${resolveCommand}" to generate missing secrets.`);
+    throw new Error(
+      buildMissingSecretsErrorMessage({
+        missing,
+        secrets,
+        secretsFilePaths,
+        appName,
+        envTemplatePath,
+        envTemplate
+      })
+    );
   }
   return replaceKvInContent(resolved, secrets, envVars, scopedKv);
 }
@@ -178,7 +200,11 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
   const secrets = await loadSecrets(secretsPath, appName);
   const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
   const scopedKv = { envKey: runEnvKey, effective };
-  let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, scopedKv);
+  let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, {
+    envKey: runEnvKey,
+    effective,
+    envTemplatePath: templatePath
+  });
   if (!secretsPath) {
     await materializeResolvedKvSecretsToUserLocal(template, secrets, scopedKv, options);
   }
@@ -227,42 +253,6 @@ function parseEnvContentToMap(content) {
   return map;
 }
 
-/**
- * Merges new .env content with existing .env: newly resolved content wins for keys it
- * defines (so project secrets take effect when re-running). Keys only in existing .env
- * are appended so manual additions are kept.
- *
- * @param {string} newContent - Newly generated .env content (from template + loadSecrets)
- * @param {Object.<string, string>} existingMap - Existing key-to-value map from current .env
- * @returns {string} Merged content: new values for keys in newContent, plus extra existing keys
- */
-function mergeEnvContentPreservingExisting(newContent, existingMap) {
-  const lines = newContent.split(/\r?\n/);
-  const newKeys = new Set();
-  const out = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) {
-      out.push(line);
-      continue;
-    }
-    const eq = trimmed.indexOf('=');
-    if (eq > 0) {
-      const key = trimmed.substring(0, eq).trim();
-      newKeys.add(key);
-    }
-    out.push(line);
-  }
-  if (existingMap && Object.keys(existingMap).length > 0) {
-    for (const key of Object.keys(existingMap)) {
-      if (!newKeys.has(key)) {
-        out.push(`${key}=${existingMap[key]}`);
-      }
-    }
-  }
-  return out.join('\n');
-}
-
 /**
  * Merges a key-value map into existing .env file content, preserving comments and blank lines.
  * For each KEY=value line in existing content, replaces value with newMap[KEY] when the key exists
@@ -320,15 +310,27 @@ function mergeEnvMapIntoContent(existingContent, newMap, options = {}) {
 
 /**
  * Resolves content to write for .env: merges with existing file when present.
+ * Uses {@link mergeEnvMapIntoContent} so new template keys are appended and comments in the
+ * existing file are preserved (unlike a full replace).
+ *
  * @param {string} resolved - Newly generated content
  * @param {string} pathToPreserve - Path to existing .env to merge from (or null)
+ * @param {Object} [options]
+ * @param {boolean} [options.freshEnv=false] - When true, write full resolved content (no merge)
  * @returns {string} Content to write
  */
-function resolveEnvContentToWrite(resolved, pathToPreserve) {
-  if (!pathToPreserve || !fs.existsSync(pathToPreserve)) return resolved;
+function resolveEnvContentToWrite(resolved, pathToPreserve, options = {}) {
+  if (options.freshEnv === true || !pathToPreserve || !fs.existsSync(pathToPreserve)) {
+    return resolved;
+  }
   const existingContent = fs.readFileSync(pathToPreserve, 'utf8');
-  const existingMap = parseEnvContentToMap(existingContent);
-  return mergeEnvContentPreservingExisting(resolved, existingMap);
+  const resolvedMap = parseEnvContentToMap(resolved);
+  let merged = mergeEnvMapIntoContent(existingContent, resolvedMap, { appendMissingFromNewMap: true });
+  if (options.pruneOrphanKv === true) {
+    const { content: pruned } = commentOrphanKvEnvLines(merged, new Set(Object.keys(resolvedMap)));
+    merged = pruned;
+  }
+  return merged;
 }
 
 /**
@@ -381,14 +383,18 @@ function resolveEnvContentToWrite(resolved, pathToPreserve) {
 async function writeResolvedEnv({ appName, envPath, resolved, variablesPath, secretsPath, opts }) {
   const preservePath = opts.preserveFromPath !== undefined && opts.preserveFromPath !== null ? opts.preserveFromPath : null;
   const pathToPreserve = preservePath !== null ? preservePath : envPath;
-  const toWrite = resolveEnvContentToWrite(resolved, pathToPreserve);
+  const toWrite = resolveEnvContentToWrite(resolved, pathToPreserve, {
+    freshEnv: opts.freshEnv === true,
+    pruneOrphanKv: opts.envOnly === true && opts.freshEnv !== true
+  });
   fs.writeFileSync(envPath, toWrite, { mode: 0o600 });
 
   if (!opts.skipOutputPath) {
     const { processEnvVariables } = require('../utils/env-copy');
     await processEnvVariables(envPath, variablesPath, appName, secretsPath, {
       preferLocalEnvOutputPath: opts.preferLocalEnvOutputPath === true,
-      appPath: opts.appPath || null
+      appPath: opts.appPath || null,
+      freshEnv: opts.freshEnv === true
     });
   }
   return envPath;

package/lib/core/secrets-env-write.js

@@ -207,7 +207,16 @@ async function resolveAndGetEnvMap(appName, options = {}) {
   let content = await secrets.generateEnvContent(appName, secretsPath, environment, force);
   content = await injectRegistryTokens(content, secretsPath, appName);
   content = await injectBashPrefixedExportLines(content, secretsPath, appName);
-  return parseEnvContentToMap(content);
+  const map = parseEnvContentToMap(content);
+  try {
+    const adminSecrets = require('./admin-secrets');
+    const { applyAdminSecretsPlatformOverlay } = require('./admin-secrets-env-overlay');
+    const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
+    applyAdminSecretsPlatformOverlay(map, adminObj);
+  } catch {
+    // admin-secrets.env optional until up-infra/setup
+  }
+  return map;
 }
 
 module.exports = { resolveAndWriteEnvFile, resolveAndGetEnvMap };

package/lib/core/secrets-infra-placeholder-sync.js

@@ -43,6 +43,8 @@ async function syncLiteralKvSecretsFromCliOverrides(
       const val = ipc.generateValueFromCatalogEntry(key, entry, crypto, placeholderContext);
       await setSecretInStore(key, val);
     }
+    const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+    if (isSetupQuietOutput()) return;
     logger.log(
       `Updated ${keys.length} secret(s) in store (catalog literals using {{${placeholder}}}).`
     );

package/lib/core/setup-installation-profile.js

@@ -0,0 +1,43 @@
+/**
+ * Setup installation profile identifiers (`dev` / `pro`).
+ *
+ * @fileoverview Normalization for setup wizard profile (local install, not login environment)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @enum {string} */
+const INSTALLATION_PROFILE = Object.freeze({
+  DEV: 'dev',
+  PRO: 'pro'
+});
+
+/**
+ * @param {unknown} value
+ * @returns {'dev'|'pro'}
+ */
+function normalizeInstallationProfile(value) {
+  const raw = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  if (raw === INSTALLATION_PROFILE.PRO || raw === 'production') {
+    return INSTALLATION_PROFILE.PRO;
+  }
+  return INSTALLATION_PROFILE.DEV;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isProInstallationProfile(value) {
+  return normalizeInstallationProfile(value) === INSTALLATION_PROFILE.PRO;
+}
+
+module.exports = {
+  INSTALLATION_PROFILE,
+  normalizeInstallationProfile,
+  isProInstallationProfile
+};

package/lib/core/setup-platform-mode.js

@@ -0,0 +1,55 @@
+/**
+ * Setup platform topology mode (`single` | `full`).
+ *
+ * This is distinct from `setupInstallationProfile` (dev/pro password bundle) and from
+ * the login/run environment (`dev` | `tst` | `pro`).
+ *
+ * @fileoverview Setup platform mode normalization and defaults
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @enum {string} */
+const SETUP_PLATFORM_MODE = Object.freeze({
+  SINGLE: 'single',
+  FULL: 'full'
+});
+
+/**
+ * @param {unknown} value
+ * @returns {'single'|'full'}
+ */
+function normalizeSetupPlatformMode(value) {
+  const raw = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  if (raw === SETUP_PLATFORM_MODE.FULL) return SETUP_PLATFORM_MODE.FULL;
+  if (raw === 'all' || raw === 'full-platform' || raw === 'platform-full') return SETUP_PLATFORM_MODE.FULL;
+  return SETUP_PLATFORM_MODE.SINGLE;
+}
+
+/**
+ * Derived config flags for a chosen platform mode.
+ *
+ * - single: direct ports, no front door ingress
+ * - full: enable Traefik ingress + env-scoped resources
+ *
+ * @param {'single'|'full'} mode
+ * @returns {{ traefik: boolean, useEnvironmentScopedResources: boolean }}
+ */
+function flagsForSetupPlatformMode(mode) {
+  const m = normalizeSetupPlatformMode(mode);
+  return {
+    traefik: m === SETUP_PLATFORM_MODE.FULL,
+    useEnvironmentScopedResources: m === SETUP_PLATFORM_MODE.FULL
+  };
+}
+
+module.exports = {
+  SETUP_PLATFORM_MODE,
+  normalizeSetupPlatformMode,
+  flagsForSetupPlatformMode
+};
+

package/lib/datasource/agent-trust-debug-log.js

@@ -21,7 +21,7 @@ async function writeTrustDebugLog(appKey, datasourceKey, payload) {
   const logPath = await writeTestLog(
     appKey,
     payload,
-    `test-trust-${datasourceKey}`,
+    `verify-trust-${datasourceKey}`,
     path.dirname(getIntegrationPath(appKey))
   );
   return logPath;

package/lib/datasource/agent-trust-run.js

@@ -14,14 +14,15 @@ const { setupIntegrationTestAuth } = require('../external-system/test-auth');
 const { resolveAppKeyForDatasource } = require('./resolve-app');
 const { getSystemKeyFromAppKey } = require('./integration-context');
 const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const { buildMinimalUploadSyncOptions } = require('../utils/upload-sync-options');
 const { fetchTrustRunFromDataplane } = require('./agent-trust-fetch');
 
-async function maybeSyncBeforeTrust({ noSync, authConfig, systemKey }) {
+async function maybeSyncBeforeTrust({ noSync, authConfig, systemKey, options = {} }) {
   if (noSync === true) return;
   requireBearerForDataplanePipeline(authConfig);
   logger.log(chalk.cyan('Syncing local config to dataplane…'));
   const { uploadExternalSystem } = require('../commands/upload');
-  await uploadExternalSystem(systemKey, { minimal: true });
+  await uploadExternalSystem(systemKey, buildMinimalUploadSyncOptions(options));
   logger.log(formatSuccessLine('Sync complete'));
 }
 
@@ -67,7 +68,8 @@ async function runDatasourceAgentTrust(datasourceKey, options = {}) {
   await maybeSyncBeforeTrust({
     noSync: options.noSync === true,
     authConfig,
-    systemKey
+    systemKey,
+    options
   });
 
   try {

package/lib/datasource/audit-evidence-extract-debug.js

@@ -6,6 +6,8 @@
 
 'use strict';
 
+const { parseCapacityDetailKey } = require('../utils/load-cip-capacity-display-config');
+
 /**
  * @param {Array<*>} ids
  * @returns {string[]}
@@ -67,32 +69,42 @@ function executionIdsFromDebugEnvelope(envelope) {
 }
 
 /**
- * CIP operation names from capacity step (insert, update, list, …).
  * @param {Object|null|undefined} envelope
- * @returns {string[]}
+ * @returns {Object|null}
  */
-function cipOperationsFromDebugEnvelope(envelope) {
-  const dbg = envelope && envelope.debug;
-  const asyncDbg = dbg && dbg.e2eAsyncDebug;
-  if (!asyncDbg || !Array.isArray(asyncDbg.stepDebug)) return [];
-  const capStep = asyncDbg.stepDebug.find(s => s && s.name === 'capacity');
-  if (!capStep || !capStep.evidence) return [];
+function getCapacityStepFromEnvelope(envelope) {
+  const asyncDbg = envelope && envelope.debug && envelope.debug.e2eAsyncDebug;
+  if (!asyncDbg || !Array.isArray(asyncDbg.stepDebug)) return null;
+  return asyncDbg.stepDebug.find(s => s && s.name === 'capacity') || null;
+}
+
+/**
+ * Operation names from CIP capacity evidence keys (`capacity:<op>#<index>`), without product aliases.
+ * @param {*} details
+ * @returns {Set<string>}
+ */
+function collectCipOpsFromCapabilityDetails(details) {
   const ops = new Set();
-  const details = capStep.evidence.datasources;
-  if (!Array.isArray(details)) return [];
+  if (!Array.isArray(details)) return ops;
   for (const ds of details) {
     if (!ds || !Array.isArray(ds.capabilityDetails)) continue;
     for (const item of ds.capabilityDetails) {
-      const key = item && item.key ? String(item.key) : '';
-      const m = key.match(/^capacity:([a-zA-Z]+)/);
-      if (m && m[1]) {
-        let op = m[1] === 'updateBasic' ? 'updatebasic' : m[1].toLowerCase();
-        if (op === 'create') op = 'insert';
-        ops.add(op);
-      }
+      const parsed = parseCapacityDetailKey(item && item.key);
+      if (parsed && parsed.op) ops.add(parsed.op);
     }
   }
-  return [...ops];
+  return ops;
+}
+
+/**
+ * CIP operation names from capacity step (insert, update, list, …).
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function cipOperationsFromDebugEnvelope(envelope) {
+  const capStep = getCapacityStepFromEnvelope(envelope);
+  if (!capStep || !capStep.evidence) return [];
+  return [...collectCipOpsFromCapabilityDetails(capStep.evidence.datasources)];
 }
 
 module.exports = {

package/lib/datasource/audit-evidence-extract.js

@@ -16,6 +16,7 @@ const {
   cipOperationsFromDebugEnvelope,
   dedupeIds: dedupeIdsFromDebug
 } = require('./audit-evidence-extract-debug');
+const loadCipCapacityDisplayConfig = require('../utils/load-cip-capacity-display-config');
 
 /** @param {Array<*>} ids @returns {string[]} */
 function dedupeIds(ids) {
@@ -88,14 +89,16 @@ function correlationIdFromEnvelope(envelope) {
 function expectedOperationsFromEnvelope(envelope) {
   const fromCapacity = cipOperationsFromDebugEnvelope(envelope);
   if (fromCapacity.length) return fromCapacity;
+  const { standardOrder } = loadCipCapacityDisplayConfig.getCipCapacityDisplayConfig();
+  const allowed = new Set(
+    (standardOrder || []).map(op => String(op).trim().toLowerCase()).filter(Boolean)
+  );
   const ops = new Set();
   const caps = envelope && Array.isArray(envelope.capabilities) ? envelope.capabilities : [];
   for (const cap of caps) {
     if (!cap || cap.status === 'skipped' || !cap.key) continue;
-    const key = String(cap.key).trim();
-    if (['insert', 'update', 'get', 'delete', 'list', 'create'].includes(key)) {
-      ops.add(key === 'create' ? 'insert' : key);
-    }
+    const key = String(cap.key).trim().toLowerCase();
+    if (allowed.has(key)) ops.add(key);
   }
   const integration = envelope && envelope.integration;
   if (integration && integration.sync && integration.sync.status === 'ok') {